Yes, managers can discuss employees with other employees, but only within limits. A conversation is generally fine when the listener has a real business reason to hear it, such as coordinating schedules, handling discipline with HR, or flagging a safety issue. It becomes a legal problem when the topic is medical, genetic, or otherwise confidential; when it targets a protected characteristic; when it’s false; when it exposes private personal facts; or when it punishes workers for talking about pay or organizing. Where the disclosure falls on that map determines what you can do about it.
What Managers Are Allowed to Share
Coordinating shifts, delegating projects, working through a performance issue with HR, warning safety personnel about a hazard: these all require some sharing of employee information, and courts recognize a doctrine called qualified privilege that shields workplace communications made in good faith to people with a legitimate reason to receive them. A supervisor telling another supervisor about a worker’s repeated tardiness so both can adjust coverage is exactly what that privilege protects.
The privilege shrinks fast when the audience expands. Sharing performance review details with a worker’s peers, venting about someone’s discipline at lunch with unrelated staff, or forwarding HR correspondence outside the management chain all exceed any business justification, and the employer loses the qualified-privilege defense. The practical test: does the person hearing this need it to do their job? If not, the manager probably shouldn’t be talking.
Medical, Disability, and Genetic Information
Federal law is strictest here. Under the Americans with Disabilities Act, any medical information an employer collects through job-related exams or health inquiries must be stored in separate medical files, apart from general personnel records, and treated as a confidential medical record.1Office of the Law Revision Counsel. 42 U.S.C. 12112 – Discrimination Only three narrow exceptions permit disclosure: supervisors and managers may be told about necessary work restrictions or accommodations, first aid and safety personnel may be informed if a disability could require emergency treatment, and government officials investigating ADA compliance may request relevant records. A manager who casually mentions an employee’s diagnosis or medication to coworkers falls outside every one of those exceptions.
The Genetic Information Nondiscrimination Act adds a second layer. Employers are prohibited from disclosing genetic information about employees, including family medical histories, and that data must be kept confidential in a separate medical file, with limited exceptions for government compliance investigations or court orders.2U.S. Equal Employment Opportunity Commission. Genetic Information Discrimination A manager who mentions that an employee’s parent has a hereditary condition is violating federal law, even offhand.
HIPAA plays a narrower role than most people assume. The Privacy Rule primarily governs healthcare providers and health plans, not employers directly. It does restrict how employer-sponsored group health plans share protected health information with the employer or plan sponsor.3U.S. Department of Health and Human Services. Am I a Covered Entity Under HIPAA? If a manager obtained health details through the company’s group plan and passed them along to other employees, the plan may be in violation.4U.S. Department of Health and Human Services. Summary of the HIPAA Privacy Rule
When Workplace Talk Becomes Harassment
A manager who repeatedly discusses an employee’s race, religion, sex, national origin, age, disability, or other protected characteristic with other staff can create a hostile work environment. Under federal anti-discrimination law, harassment becomes illegal when the conduct is severe or pervasive enough that a reasonable person would find the workplace intimidating, hostile, or abusive.5U.S. Equal Employment Opportunity Commission. Harassment One isolated remark rarely clears that bar, but a pattern of a manager mocking an employee’s accent to coworkers, or regularly circulating details about someone’s medical condition as gossip, can.
The victim doesn’t have to be the person the manager was talking about. Anyone affected by the offensive conduct can have a claim.
Defamation and Privacy Claims
False Statements
A manager who spreads false information about a subordinate to other employees may be liable for defamation. An employee generally needs to show the manager made a false statement of fact (not just a negative opinion), communicated it to at least one other person, acted with at least negligence about the truth, and caused reputational harm. “I don’t think she’s a strong performer” is opinion. “She’s been stealing from the register” is a factual claim, and if it’s false, the employee can pursue damages for lost wages, emotional distress, and harm to future career prospects.
Filing deadlines here are short. In most states, defamation must be filed within one to three years of the statement, and some states start the clock from the first publication even if the employee learned about it later. Waiting to see if it blows over often means waiting too long.
Private Facts
Even true statements can be actionable. The privacy tort called public disclosure of private facts applies when a manager shares non-public personal information that a reasonable person would find highly offensive, and the information has no legitimate connection to workplace operations. Discussing an employee’s specific financial difficulties, details of their divorce, or a private medical situation with coworkers can fit. The information must not already be a matter of public record, and the disclosure must go beyond what any reasonable business purpose would require.
Talk That Follows You to the Next Job
When a manager’s loose talk reaches a prospective employer, tortious interference with prospective economic advantage may apply. The employee has to show a reasonable expectation of getting the position, an intentional wrongful act by the manager (such as sharing defamatory statements or confidential information), and a direct economic loss from the interference. Informal back-channel references that include false or private information can create real exposure for both the manager and the former employer.
Wage Talk and Organizing
The National Labor Relations Act protects most private-sector employees’ right to engage in concerted activity, which includes talking with coworkers about wages, benefits, hours, and working conditions. A manager cannot use discussions about employees to interfere with, restrain, or coerce workers exercising those rights.6National Labor Relations Board. Concerted Activity If a manager tells other employees that a coworker is “causing trouble” by asking about pay rates or supporting a union, that conversation itself can violate federal labor law. The protections apply whether or not a union exists.
Pay is a common flashpoint. Policies that prohibit employees from discussing their wages are unlawful, and so are policies that require permission before those conversations. Managers cannot discipline, threaten, interrogate, or place employees under surveillance for talking about compensation.7National Labor Relations Board. Your Right to Discuss Wages A manager who singles out wage discussions for punishment while allowing other personal conversations is on shaky ground. When the NLRB finds a violation, it can order remedies including back pay and reinstatement.
If You Report It, You’re Protected From Retaliation
Employees who report a manager for improperly sharing protected information are shielded from retaliation under multiple federal laws. Protected activity includes filing a complaint, participating in an investigation, or simply raising the concern with a supervisor, and an employee doesn’t need to use precise legal terms.8U.S. Equal Employment Opportunity Commission. Retaliation A reasonable belief that something violates EEO laws is enough, even if the legal theory turns out to be imperfect.
Retaliation doesn’t have to mean termination. Any action that would discourage a reasonable employee from complaining can qualify: unfavorable schedule changes, undeserved negative performance reviews, reduced responsibilities, denied transfers or promotions, unusually burdensome assignments. The question is whether the action would have dissuaded a reasonable worker from reporting.
How to Document and Report
Strong documentation is what separates a complaint that gets taken seriously from one that goes nowhere. Write down exactly what the manager said, who was present, and when. Include the specific words if you can recall them. Save emails, Slack messages, and chat logs that show the disclosure. Note any coworkers willing to confirm what they heard. Keep a personal copy of everything outside company systems in case your access is later restricted.
Stick to facts. “On March 12, Manager X told employees A, B, and C that I am taking medication for depression” is useful. “Manager X is always talking about me behind my back” is not. Investigators need dates, names, locations, and substance.
Most companies expect internal complaints through HR or a designated compliance officer before outside remedies. Submit your documentation in writing, keep proof of when you sent it and to whom, and reference the specific handbook policies you believe were violated.
If internal resolution fails or feels unsafe, the outside routes depend on the claim. Discrimination, harassment, and retaliation tied to a protected characteristic go to the EEOC, generally within 180 days of the incident, extended to 300 days in states with their own enforcement agencies. NLRA violations involving interference with concerted activity or wage discussions go to the nearest regional office of the National Labor Relations Board. Defamation and privacy tort claims are filed as civil lawsuits in state court, where filing fees typically run $200 to $500 and the statutes of limitations are short.